Random named file in home directory, possibly hacked?

Question

I am running Fedora 20, and today I found a file that looks highly suspicious in my home directory. The name of the file appears to be a base64 encoded string, but doesn't decode to anything meaningful:

n5LJFcZz+8slfpALAFzHk8msAh9vsDCiYwKvzw8uAirPE00Jq9HqTSvlT9ChhjZtA==

The contents of the file are here:

http://pastebin.com/6Ba6zZem

Any idea on what I am looking at? I am going to run rkhunter on my machine, is there anything else I should do?

update: The file is owned by my username, which is the only user on this machine:

$ stat n5LJFcZz+8slfpALAFzHk8msAh9vsDCiYwKvzw8uAirPE00Jq9HqTSvlT9ChhjZtA== File: ‘n5LJFcZz+8slfpALAFzHk8msAh9vsDCiYwKvzw8uAirPE00Jq9HqTSvlT9ChhjZtA==’ Size: 888 Blocks: 8 IO Block: 4096 regular file Device: fd05h/64773d Inode: 3021277 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 1000/mvandemar) Gid: ( 1000/mvandemar) Context: unconfined_u:object_r:user_home_t:s0 Access: 2014-07-23 12:51:37.316782678 -0400 Modify: 2014-05-28 18:25:21.362568805 -0400 Change: 2014-05-28 18:25:21.364568810 -0400 Birth: -

I have no idea what I was doing 2 months ago at that time. lsof had no output at all. sshd is not running on my machine (nor do I see any ssh logins via last), although I do see this command via htop:

/usr/bin/ssh-agent /bin/sh -c exec -l /bin/bash -c "cinnamon-session-cinnamon"

Not sure what else I should look for.

Answer 1

It is extremely improbable that this represents a security breach. A badly-implemented malware would use a dot file for a modicum of stealth. A better-implemented malware would hide itself by patching the kernel so that no file would ever appear.

The mundane explanation is that you accidentally pasted a line containing the character > followed by this text in a terminal. This caused the shell running in that terminal to create the file, since > followed by a file name is an output redirection. If there was anything else on the line, or if there were other lines, the shell probably complained of numerous syntax errors, in an incident which you've forgotten after all these months.

The name of the file is encoded in Base64. It's the last part of a block (given the = at the end) whose beginning is missing. There were probably multiple lines of base64-encoded data, with > at the beginning of a line as a continuation or quoting character.

You can look at the content of the file, it might give you a clue as to what you pasted. It's unlikely to be important though. Just delete that file.

Answer 2

You can try to find out what process is creating the file with the lsof command:

lsof n5LJFcZz+8slfpALAFzHk8msAh9vsDCiYwKvzw8uAirPE00Jq9HqTSvlT9ChhjZtA==1

A more powerful tool is inotify which can monitor directories for the creation of specific files.

Take a look at Determine which process is creating a file for more info.